amadey | c78777069b2552b8d7d1ff4705790f26b7f1fe56545d789d196a59cde1216fdb | Triage

Sharing

General

Target

c78777069b2552b8d7d1ff4705790f26b7f1fe56545d789d196a59cde1216fdb
Size

490KB
Sample

230507-lqv3gaec36
MD5

6ad96015312a7d7ec92253ba92f8a8a4
SHA1

4e4860eb6f634db0d0d02c048cb198c7ea22c09d
SHA256

c78777069b2552b8d7d1ff4705790f26b7f1fe56545d789d196a59cde1216fdb
SHA512

c31bb4dbdead27e075e790a50ef90c11740900a693e839d6a5874c05d179d521961e418822d37fbb0600e86ec059b38b0a3b67454a2f987607fccabbbd227ab1
SSDEEP

12288:1MrYy90TrWCfZppvIR62dKeneeJmBwLuEJbEn:pygrpvIVeDaLuEq

Score

10^/10

amadey redline lada discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

lada

C2

217.196.96.101:4132

Attributes

auth_value
0b3678897547fedafe314eda5a2015ba

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Targets

- Target
  
  c78777069b2552b8d7d1ff4705790f26b7f1fe56545d789d196a59cde1216fdb
- Size
  
  490KB
- MD5
  
  6ad96015312a7d7ec92253ba92f8a8a4
- SHA1
  
  4e4860eb6f634db0d0d02c048cb198c7ea22c09d
- SHA256
  
  c78777069b2552b8d7d1ff4705790f26b7f1fe56545d789d196a59cde1216fdb
- SHA512
  
  c31bb4dbdead27e075e790a50ef90c11740900a693e839d6a5874c05d179d521961e418822d37fbb0600e86ec059b38b0a3b67454a2f987607fccabbbd227ab1
- SSDEEP
  
  12288:1MrYy90TrWCfZppvIR62dKeneeJmBwLuEJbEn:pygrpvIVeDaLuEq
Score

10^/10

amadey redline lada discovery evasion infostealer persistence spyware stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

amadeyredlineladadiscoveryevasioninfostealerpersistencespywarestealertrojan